freespeechfandomcom-20200214-history
Web of trust
In cryptography, a web of trust is a concept used in PGP, GnuPG, and other OpenPGP-compatible systems to establish the authenticity of the binding between a public key and a user. Its decentralized grass roots trust model is an alternative to the centralized trust model of a public key infrastructure (PKI), which relies exclusively on a certificate authority (or a hierarchy of such). As with computer networks, there are many independent webs of trust, and any user (through their identity certificate) can be a part of, and a link between, multiple webs. The web of trust concept was first put forth by PGP creator Phil Zimmermann in 1992 in the manual for PGP version 2.0: Operation of a web of trust All OpenPGP-compliant implementations include a certificate vetting scheme to assist with this; its operation has been termed a web of trust. OpenPGP identity certificates (which include public key(s) and owner information) can be digitally signed by other users who, by that act, endorse the association of that public key with the person or entity listed in the certificate. This is commonly done at key signing parties. OpenPGP-compliant implementations also include a vote counting scheme which can be used to determine which public key – owner association a user will trust while using PGP. For instance, if three partially trusted endorsers have vouched for a certificate (and so its included public key – owner binding), OR if one fully trusted endorser has done so, the association between owner and public key in that certificate will be trusted to be correct. The parameters are user-adjustable (e.g., no partials at all, or perhaps 6 partials) and can be completely bypassed if desired. The scheme is flexible, unlike most public key infrastructure designs, and leaves trust decision(s) in the hands of individual users. It is not perfect and requires both caution and intelligent supervision by users. Essentially all PKI designs are less flexible and require users to follow the trust endorsement of the PKI generated, certificate authority (CA)-signed, certificates. Intelligence is normally neither required nor allowed. These arrangements are not perfect either, and require both caution and care by users. Contrast with typical PKI In contrast, a typical X.509 PKI permits each certificate to be signed only by a single party: a certificate authority (CA). The CA's certificate may itself be signed by a different CA, all the way up to a 'self-signed' root certificate. Root certificates must be available to those who use a lower level CA certificate and so are typically distributed widely. They are for instance, distributed with such applications as browsers and email clients. In this way SSL/TLS-protected Web pages, email messages, etc. can be authenticated without requiring users to manually install root certificates. Applications commonly include over one hundred root certificates from dozens of PKIs, thus by default bestowing trust throughout the hierarchy of certificates which lead back to them. Many of these root certificates were created by companies which collapsed, e.g. as the Dot-com bubble burst. Unless those PKIs are still properly managed the root certificates almost certainly should not be relied upon now. Web of trust problems The OpenPGP web of trust is essentially unaffected by such things as company failures, and has continued to function with little change. However, a related problem does occur. Users, whether individuals or organizations, who lose track of a private key can no longer decrypt messages sent to them produced using the matching public key found in an OpenPGP certificate. Early PGP certificates did not include expiry dates, and those certificates had unlimited lives. Users had to prepare a signed cancellation certificate against the time when the matching private key was lost or compromised. One very prominent cryptographer is still getting messages encrypted using a public key for which he long ago lost track of the private key (Ferguson 2003, p.333). He can't do much with those messages except discard them after notifying the sender that they were unreadable and requesting resending with a public key for which he still has the matching private key. Later PGP, and all OpenPGP compliant certificates include expiry dates which automatically preclude such troubles (eventually) when used sensibly. This problem can also be easily avoided by the use of "designated revokers", which were introduced in the early 1990s. A key owner may designate a third party that has permission to revoke the key owner's key if the key owner loses his own private key and thus loses the ability to revoke his own public key. A non-technical, social, difficulty with a Web of Trust like the one built into PGP/OpenPGP type systems is that every web of trust without a central controller (eg, a CA) depends on other users for trust. Those with new certificates (ie, produced in the process of generating a new key pair) will not likely be readily trusted by other users' systems, that is by those they have not personally met, until they find enough endorsements for the new certificate. This is because many other Web of Trust users will have their certificate vetting set to require one or more fully trusted endorsers of an otherwise unknown certificate (or perhaps several partial endorsers) before using the public key in that certificate to prepare messages, believe signatures, etc. Despite the wide use of OpenPGP compliant systems and easy availability of on-line multiple key servers, it is possible in practice to be unable to readily find someone (or several people) to endorse a new certificate (eg, by comparing physical identification to key owner information and then digitally signing the new certificate). Users in remote areas or undeveloped ones, for instance, may find other users scarce. And, if the other's certificate is also new (and with no or few endorsements from others), then its signature on any new certificate can offer only marginal benefit toward becoming trusted by still other parties' systems and so able to securely exchange messages with them. Key signing parties are a relatively popular mechanism to resolve this problem of finding other users who can install one's certificate in existing webs of trust by endorsing it. Websites also exist to facilitate the location of other OpenPGP users to arrange keysignings. The Gossamer Spider Web of Trust also makes key verification easier by linking OpenPGP users via a hierarchal style web of trust where end users can benefit by coincidental or determined trust of someone who is endorsed as an introducer, or by explicitly trusting GSWoT's top-level key minimally as a level 2 introducer (the top-level key endorses level 1 introducers). The possibility of finding chains of certificates is often justified by the "small world phenomenon": given two individuals, it is often possible to find a short chain of people between them such that each person in the chain knows the preceding and following links. However, such a chain is not necessarily useful: the person encrypting an email or verifying a signature not only has to find a chain of signatures from his private key to his correspondent's, but also to trust each person of the chain to be honest and competent about signing keys (that is, he has to judge whether these people are likely to honestly follow the guidelines about verifying the identity of people before signing keys). This is a much stronger constraint. Doing the math The work of Audun Jøsang is an algebraic treatment of trust measurements and methods and calculation that attempts to capture how trust varies as it "traverses" a web of trust. The other sites (below) contains a link to his publications. A good one to start with might be "An Algebra for Assessing Trust in Certification Chains". Also see Subjective logic and Trust metric. See also * Virtual community * The CAcert authority issues costless X.509 certificates rather than OpenPGP. It requires that those with advanced functionality are checked through a web of trust. * Also Thawte operates a web-of-trust, which allows to validate the identity of members, however issues client (email) certificates only. External links General *An explanation of the PGP Web of Trust *"The PGP Trust Model" - by Alfarez Abdul-Rahman *Overview of Certification Systems: X.509, CA, PGP and SKIP *Comparison Of Secure Email Technologies - X.509 / PKI, PGP, and IBE PGP Key Analysis *Current key analysis reports - maintained by Jason Harris *PGP Web of Trust Statistics - analysis by Neal McBurnett in 1996 *Analysis of a large OpenPGP ring - analysis by Drew Streib in 2001-2002 *Analysis of the PGP strong set - maintained by Henk Penning Web of Trust statistics and tools *Wotsap - Web of trust statistics and pathfinder *The Footsie Web of Trust analysis *PGP tools, pathfinder, references from Henk P. Penning *Individual key statistics from Thomas Butter *Web of Trust RDF Vocabulary Other trust-related tools and sites *Trust-forum: a project of web-based communication system that aims to include a web of trust between servers based on trust declarations between users. *Trust Metrics Evaluation Project wiki. *Semantic Web Trust and Security Resource Guide *Subjective logic demonstrator *Web of Trust Patent, Epinions *Epinions history References Category:Key management Category:Asymmetric-key cryptosystems Category:Online social networking Category:PGP Category:Semantic Web de:Web of Trust it:Web of trust nl:Web van vertrouwen pl:Sieć zaufania vi:Mạng lưới tín nhiệm